Response Actions

As a result of an incident investigation, different response actions are possible.

After or during the investigation of malicious activity in your network, Cortex XDR offers various response actions that enable you investigate the endpoint and take immediate action to remediate it. For example, when you detect a compromised endpoint, you can isolate it from your network to prevent it from communicating with any other internal or external device and thereby reducing an attacker’s mobility on your network. The available response actions in Cortex XDR are:

Initiate a Live Terminal Session

Isolate an Endpoint

Pause Endpoint Protection

Run Scripts on an Endpoint

Remediate Changes from Malicious Activity

Search and Destroy Malicious Files

Manage External Dynamic Lists

For response actions that rely on a Cortex XDR agent, the following table describes the supported platforms and minimal agent version. A dash (—) indicates the setting is not supported.

Module	Windows	Mac	Linux
Initiate a Live Terminal Session Initiates a remote connection to an endpoint allowing you to investigate and respond to security events on endpoints. Using Live Terminal you can navigate and manage files in the file system, manage active processes, and run the operating system or Python commands.	X `Cortex` `XDR` agent 6.1 and later	X `Cortex` `XDR` agent 7.0 and later	X `Cortex` `XDR` agent 7.0 and later
Isolate an Endpoint Halts all network access on the endpoint except for traffic to `Cortex` `XDR` to prevent a compromised endpoint from communicating with any other internal or external device.	X `Cortex` `XDR` agent 6.0 and later	X `Cortex` `XDR` agent 7.3 and later on macOS 10.15.4 and later	—
Run Scripts on an Endpoint Allows executing Python 3.7 scripts on your endpoints directly from `Cortex` `XDR`, including pre-canned scripts provided by `Cortex` `XDR` or your own Python scripts and code snippets.	X `Cortex` `XDR` agent 7.1 and later	X `Cortex` `XDR` agent 7.1 and later	X `Cortex` `XDR` agent 7.1 and later
Remediate Changes from Malicious Activity Investigates suspicious causality process chains and incidents on your endpoints, and displays a list of suggested actions to remediate processes, files and registry keys on your endpoint that were changed as a result of malicious activity.	X `Cortex` `XDR` agent 7.2 and later	—	—
Search and Destroy Malicious Files Searches for the presence of known and suspected malicious files on endpoints and destroys the file from endpoints where it exists.	X `Cortex` `XDR` agent 7.2 and later	X `Cortex` `XDR` agent 7.3 and later on macOS 10.15.4 and later	—

Response actions are not supported for Android endpoints.

Document:Cortex® XDR Pro Administrator’s Guide

Response Actions

Response Actions

Recommended For You

Document:Cortex® XDR Pro Administrator’s Guide

Response Actions

Response Actions

Recommended For You

Recommended Videos